CVE-2024-45011 (GCVE-0-2024-45011)

Vulnerability from cvelistv5 – Published: 2024-09-11 15:13 – Updated: 2025-11-03 22:15
VLAI?
Summary
In the Linux kernel, the following vulnerability has been resolved: char: xillybus: Check USB endpoints when probing device Ensure, as the driver probes the device, that all endpoints that the driver may attempt to access exist and are of the correct type. All XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at address 1. This is verified in xillyusb_setup_base_eps(). On top of that, a XillyUSB device may have additional Bulk OUT endpoints. The information about these endpoints' addresses is deduced from a data structure (the IDT) that the driver fetches from the device while probing it. These endpoints are checked in setup_channels(). A XillyUSB device never has more than one IN endpoint, as all data towards the host is multiplexed in this single Bulk IN endpoint. This is why setup_channels() only checks OUT endpoints.
Severity ?
No CVSS data available.
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: a53d1202aef122894b6e46116a92174a9123db5d , < 25ee8b2908200fc862c0434e5ad483817d50ceda (git)
Affected: a53d1202aef122894b6e46116a92174a9123db5d , < 4267131278f5cc98f8db31d035d64bdbbfe18658 (git)
Affected: a53d1202aef122894b6e46116a92174a9123db5d , < 5cff754692ad45d5086b75fef8cc3a99c30a1005 (git)
Affected: a53d1202aef122894b6e46116a92174a9123db5d , < 1371d32b95972d39c1e6e4bae8b6d0df1b573731 (git)
Affected: a53d1202aef122894b6e46116a92174a9123db5d , < 2374bf7558de915edc6ec8cb10ec3291dfab9594 (git)
Create a notification for this product.
    Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.166 , ≤ 5.15.* (semver)
Unaffected: 6.1.107 , ≤ 6.1.* (semver)
Unaffected: 6.6.48 , ≤ 6.6.* (semver)
Unaffected: 6.10.7 , ≤ 6.10.* (semver)
Unaffected: 6.11 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-45011",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-09-29T15:50:39.730810Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-09-29T15:50:54.451Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2025-11-03T22:15:18.241Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/xillybus/xillyusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "25ee8b2908200fc862c0434e5ad483817d50ceda",
              "status": "affected",
              "version": "a53d1202aef122894b6e46116a92174a9123db5d",
              "versionType": "git"
            },
            {
              "lessThan": "4267131278f5cc98f8db31d035d64bdbbfe18658",
              "status": "affected",
              "version": "a53d1202aef122894b6e46116a92174a9123db5d",
              "versionType": "git"
            },
            {
              "lessThan": "5cff754692ad45d5086b75fef8cc3a99c30a1005",
              "status": "affected",
              "version": "a53d1202aef122894b6e46116a92174a9123db5d",
              "versionType": "git"
            },
            {
              "lessThan": "1371d32b95972d39c1e6e4bae8b6d0df1b573731",
              "status": "affected",
              "version": "a53d1202aef122894b6e46116a92174a9123db5d",
              "versionType": "git"
            },
            {
              "lessThan": "2374bf7558de915edc6ec8cb10ec3291dfab9594",
              "status": "affected",
              "version": "a53d1202aef122894b6e46116a92174a9123db5d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/char/xillybus/xillyusb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.166",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.107",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.48",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.10.*",
              "status": "unaffected",
              "version": "6.10.7",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.11",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.166",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.107",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.48",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.10.7",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.11",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nchar: xillybus: Check USB endpoints when probing device\n\nEnsure, as the driver probes the device, that all endpoints that the\ndriver may attempt to access exist and are of the correct type.\n\nAll XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at\naddress 1. This is verified in xillyusb_setup_base_eps().\n\nOn top of that, a XillyUSB device may have additional Bulk OUT\nendpoints. The information about these endpoints\u0027 addresses is deduced\nfrom a data structure (the IDT) that the driver fetches from the device\nwhile probing it. These endpoints are checked in setup_channels().\n\nA XillyUSB device never has more than one IN endpoint, as all data\ntowards the host is multiplexed in this single Bulk IN endpoint. This is\nwhy setup_channels() only checks OUT endpoints."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T09:30:58.721Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/25ee8b2908200fc862c0434e5ad483817d50ceda"
        },
        {
          "url": "https://git.kernel.org/stable/c/4267131278f5cc98f8db31d035d64bdbbfe18658"
        },
        {
          "url": "https://git.kernel.org/stable/c/5cff754692ad45d5086b75fef8cc3a99c30a1005"
        },
        {
          "url": "https://git.kernel.org/stable/c/1371d32b95972d39c1e6e4bae8b6d0df1b573731"
        },
        {
          "url": "https://git.kernel.org/stable/c/2374bf7558de915edc6ec8cb10ec3291dfab9594"
        }
      ],
      "title": "char: xillybus: Check USB endpoints when probing device",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2024-45011",
    "datePublished": "2024-09-11T15:13:48.969Z",
    "dateReserved": "2024-08-21T05:34:56.681Z",
    "dateUpdated": "2025-11-03T22:15:18.241Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.14\", \"versionEndExcluding\": \"5.15.166\", \"matchCriteriaId\": \"9F971490-28BA-4CF2-B6ED-DC618507AC3A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"5.16\", \"versionEndExcluding\": \"6.1.107\", \"matchCriteriaId\": \"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.2\", \"versionEndExcluding\": \"6.6.48\", \"matchCriteriaId\": \"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"versionStartIncluding\": \"6.7\", \"versionEndExcluding\": \"6.10.7\", \"matchCriteriaId\": \"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8B3CE743-2126-47A3-8B7C-822B502CF119\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"4DEB27E7-30AA-45CC-8934-B89263EF3551\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nchar: xillybus: Check USB endpoints when probing device\\n\\nEnsure, as the driver probes the device, that all endpoints that the\\ndriver may attempt to access exist and are of the correct type.\\n\\nAll XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at\\naddress 1. This is verified in xillyusb_setup_base_eps().\\n\\nOn top of that, a XillyUSB device may have additional Bulk OUT\\nendpoints. The information about these endpoints\u0027 addresses is deduced\\nfrom a data structure (the IDT) that the driver fetches from the device\\nwhile probing it. These endpoints are checked in setup_channels().\\n\\nA XillyUSB device never has more than one IN endpoint, as all data\\ntowards the host is multiplexed in this single Bulk IN endpoint. This is\\nwhy setup_channels() only checks OUT endpoints.\"}, {\"lang\": \"es\", \"value\": \"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: char: xillybus: Comprobar los endpoints USB al sondear el dispositivo Aseg\\u00farese de que, mientras el controlador sondea el dispositivo, todos los endpoints a los que el controlador puede intentar acceder existan y sean del tipo correcto. Todos los dispositivos XillyUSB deben tener un endpoint Bulk IN y Bulk OUT en la direcci\\u00f3n 1. Esto se verifica en xillyusb_setup_base_eps(). Adem\\u00e1s de eso, un dispositivo XillyUSB puede tener endpoints Bulk OUT adicionales. La informaci\\u00f3n sobre las direcciones de estos endpoints se deduce de una estructura de datos (IDT) que el controlador obtiene del dispositivo mientras lo sondea. Estos endpoints se comprueban en setup_channels(). Un dispositivo XillyUSB nunca tiene m\\u00e1s de un endpoint IN, ya que todos los datos hacia el host se multiplexan en este \\u00fanico endpoint Bulk IN. Es por eso que setup_channels() solo comprueba los endpoints OUT.\"}]",
      "id": "CVE-2024-45011",
      "lastModified": "2024-09-13T16:36:55.757",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"baseScore\": 5.5, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"LOCAL\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"LOW\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"HIGH\"}, \"exploitabilityScore\": 1.8, \"impactScore\": 3.6}]}",
      "published": "2024-09-11T16:15:06.550",
      "references": "[{\"url\": \"https://git.kernel.org/stable/c/1371d32b95972d39c1e6e4bae8b6d0df1b573731\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/2374bf7558de915edc6ec8cb10ec3291dfab9594\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/25ee8b2908200fc862c0434e5ad483817d50ceda\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/4267131278f5cc98f8db31d035d64bdbbfe18658\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}, {\"url\": \"https://git.kernel.org/stable/c/5cff754692ad45d5086b75fef8cc3a99c30a1005\", \"source\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"tags\": [\"Patch\"]}]",
      "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "vulnStatus": "Analyzed",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"NVD-CWE-noinfo\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-45011\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2024-09-11T16:15:06.550\",\"lastModified\":\"2025-11-03T23:15:49.580\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nchar: xillybus: Check USB endpoints when probing device\\n\\nEnsure, as the driver probes the device, that all endpoints that the\\ndriver may attempt to access exist and are of the correct type.\\n\\nAll XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at\\naddress 1. This is verified in xillyusb_setup_base_eps().\\n\\nOn top of that, a XillyUSB device may have additional Bulk OUT\\nendpoints. The information about these endpoints\u0027 addresses is deduced\\nfrom a data structure (the IDT) that the driver fetches from the device\\nwhile probing it. These endpoints are checked in setup_channels().\\n\\nA XillyUSB device never has more than one IN endpoint, as all data\\ntowards the host is multiplexed in this single Bulk IN endpoint. This is\\nwhy setup_channels() only checks OUT endpoints.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: char: xillybus: Comprobar los endpoints USB al sondear el dispositivo Aseg\u00farese de que, mientras el controlador sondea el dispositivo, todos los endpoints a los que el controlador puede intentar acceder existan y sean del tipo correcto. Todos los dispositivos XillyUSB deben tener un endpoint Bulk IN y Bulk OUT en la direcci\u00f3n 1. Esto se verifica en xillyusb_setup_base_eps(). Adem\u00e1s de eso, un dispositivo XillyUSB puede tener endpoints Bulk OUT adicionales. La informaci\u00f3n sobre las direcciones de estos endpoints se deduce de una estructura de datos (IDT) que el controlador obtiene del dispositivo mientras lo sondea. Estos endpoints se comprueban en setup_channels(). Un dispositivo XillyUSB nunca tiene m\u00e1s de un endpoint IN, ya que todos los datos hacia el host se multiplexan en este \u00fanico endpoint Bulk IN. Es por eso que setup_channels() solo comprueba los endpoints OUT.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.14\",\"versionEndExcluding\":\"5.15.166\",\"matchCriteriaId\":\"9F971490-28BA-4CF2-B6ED-DC618507AC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.107\",\"matchCriteriaId\":\"53954FF8-CB48-4302-BC4C-9DA7A88F44A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.48\",\"matchCriteriaId\":\"9DE9201A-CE6B-4726-BABB-8265EA0F8AE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.10.7\",\"matchCriteriaId\":\"D2AFDFD1-D95A-4EB7-843B-5E7659518B67\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8B3CE743-2126-47A3-8B7C-822B502CF119\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"4DEB27E7-30AA-45CC-8934-B89263EF3551\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.11:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0005AEF-856E-47EB-BFE4-90C46899394D\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1371d32b95972d39c1e6e4bae8b6d0df1b573731\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/2374bf7558de915edc6ec8cb10ec3291dfab9594\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/25ee8b2908200fc862c0434e5ad483817d50ceda\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/4267131278f5cc98f8db31d035d64bdbbfe18658\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/5cff754692ad45d5086b75fef8cc3a99c30a1005\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}",
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CVE Program Container\", \"references\": [{\"url\": \"https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html\"}], \"providerMetadata\": {\"orgId\": \"af854a3a-2127-422b-91ae-364da2661108\", \"shortName\": \"CVE\", \"dateUpdated\": \"2025-11-03T22:15:18.241Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-45011\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-09-29T15:50:39.730810Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-09-29T15:50:43.826Z\"}}], \"cna\": {\"title\": \"char: xillybus: Check USB endpoints when probing device\", \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"a53d1202aef122894b6e46116a92174a9123db5d\", \"lessThan\": \"25ee8b2908200fc862c0434e5ad483817d50ceda\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a53d1202aef122894b6e46116a92174a9123db5d\", \"lessThan\": \"4267131278f5cc98f8db31d035d64bdbbfe18658\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a53d1202aef122894b6e46116a92174a9123db5d\", \"lessThan\": \"5cff754692ad45d5086b75fef8cc3a99c30a1005\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a53d1202aef122894b6e46116a92174a9123db5d\", \"lessThan\": \"1371d32b95972d39c1e6e4bae8b6d0df1b573731\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"a53d1202aef122894b6e46116a92174a9123db5d\", \"lessThan\": \"2374bf7558de915edc6ec8cb10ec3291dfab9594\", \"versionType\": \"git\"}], \"programFiles\": [\"drivers/char/xillybus/xillyusb.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"5.14\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"5.14\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.15.166\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"6.1.107\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.1.*\"}, {\"status\": \"unaffected\", \"version\": \"6.6.48\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.6.*\"}, {\"status\": \"unaffected\", \"version\": \"6.10.7\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"6.10.*\"}, {\"status\": \"unaffected\", \"version\": \"6.11\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"drivers/char/xillybus/xillyusb.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/25ee8b2908200fc862c0434e5ad483817d50ceda\"}, {\"url\": \"https://git.kernel.org/stable/c/4267131278f5cc98f8db31d035d64bdbbfe18658\"}, {\"url\": \"https://git.kernel.org/stable/c/5cff754692ad45d5086b75fef8cc3a99c30a1005\"}, {\"url\": \"https://git.kernel.org/stable/c/1371d32b95972d39c1e6e4bae8b6d0df1b573731\"}, {\"url\": \"https://git.kernel.org/stable/c/2374bf7558de915edc6ec8cb10ec3291dfab9594\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nchar: xillybus: Check USB endpoints when probing device\\n\\nEnsure, as the driver probes the device, that all endpoints that the\\ndriver may attempt to access exist and are of the correct type.\\n\\nAll XillyUSB devices must have a Bulk IN and Bulk OUT endpoint at\\naddress 1. This is verified in xillyusb_setup_base_eps().\\n\\nOn top of that, a XillyUSB device may have additional Bulk OUT\\nendpoints. The information about these endpoints\u0027 addresses is deduced\\nfrom a data structure (the IDT) that the driver fetches from the device\\nwhile probing it. These endpoints are checked in setup_channels().\\n\\nA XillyUSB device never has more than one IN endpoint, as all data\\ntowards the host is multiplexed in this single Bulk IN endpoint. This is\\nwhy setup_channels() only checks OUT endpoints.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.166\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.1.107\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.6.48\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.10.7\", \"versionStartIncluding\": \"5.14\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.11\", \"versionStartIncluding\": \"5.14\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2025-05-04T09:30:58.721Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-45011\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2025-11-03T22:15:18.241Z\", \"dateReserved\": \"2024-08-21T05:34:56.681Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2024-09-11T15:13:48.969Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.